CVE-2021-21975

CVE-2021-21975 SSRF-POC - ssrf에서 인증 정보 유출까지 먼저 pd 클라이언트를 구성하세요. 이제 ./pd deploy http-new-requests 를 실행하세요. 이제 스크립트에서 pipedream http 요청예: Randomstring.m.pipedream.net을 교체하세요. 이것을 별도의 터미널에서 실행하세요 - ./pd logs new-requests | tee -a req.txt 그리고 이제 이것을 다른 터미널에서 실행하세요 - python3 CVE-2021-21975.py iplist c...

CLEANSTART-2026-BM33422 crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user

Security vulnerability affects the apache2 package. A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user...

CVE-2023-27163

CVE-2023-27163 이것은 CVE-2023-27163에 대한 PoC입니다. 이는 request-baskets v1.2.1까지 존재하는 SSRF 취약점입니다. 이 취약점을 통해 공격자는 /api/baskets/name을 통해 민감한 네트워크 리소스에 접근할 수 있습니다. request-baskets에는 사용자가 요청을 전달할 다른 서버를 지정할 수 있는 기능이 포함되어 있습니다. 여기서 문제는 사용자가 네트워크로 차단된 내부 애플리케이션과 같은 의도하지 않은 서비스도 지정할 수 있다는 점입니다. 사용법 $ python3...

CVE-2021-40438

CVE-2021-40438 Apache 포워드 요청 CVE CVE-2021-40438: 조작된 요청 URI 경로로 인해 modproxy가 원격 사용자가 선택한 오리진 서버로 요청을 포워드할 수 있습니다. 이 취약점은 Apache HTTP Server 2.4.48 및 이전 버전에 영향을 미칩니다. 이 CVE는 DoS 공격에서 원본 IP를 스푸핑하는 데 사용될 수 있습니다. app.netlas.io에서 취약한 서버 쿼리: cve.basescore:8 and geo.country:"RU" and...

CVE-2021-40438

CVE-2021-40438 요청 uri-path는 modproxy가 요청을 원격 사용자가 선택한 원본 서버로 전달하도록 만들 수 있습니다. 이 문제는 Apache HTTP Server 2.4.48 및 이전 버전에 영향을 미칩니다. 공격자는 요청을 제작하여 이 취약점의 uri-path를 악용할 수 있으며, 이로 인해 modproxy가 요청을 공격자가 선택한 원본 서버로 전달하게 됩니다. Apache HTTP Server의 modproxy 구성 요소는 Apache HTTP Server를 위한 프록시/게이트웨이 기능을 구현하도록...

CVE-2026-77803

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77802

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77803 Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803

Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , contains a front-end request desynchronization vulnerability in the proxy request forwarding component. The root cause is that the software forwards requests containing both Content-Length and Transfer-Encoding ...

EUVD-2026-92426

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

EUVD-2026-92425

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

CVE-2026-77802: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77803: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...